JP4296888B2 - Electronic control unit - Google Patents

Description

  The present invention relates to an electronic control device, and more particularly to a failure detection mode thereof.

Conventionally, as a failure detection mode of an electronic control device, for example, one described in Patent Document 1 is known. In the apparatus described in this document, the sensor signals of two sensors of the same type are input, and the same arithmetic processing is performed in two systems. At this time, the calculation processing is divided into a plurality of steps, and a failure is detected by comparing the calculation results of both systems at the end of each step. Therefore, when a failure is detected, the step of the arithmetic processing that is a failure can be specified. As a result, the time required to find the fault location is shortened.
Japanese Patent Laid-Open No. 11-31011 (FIG. 1)

  By the way, in the apparatus described in Patent Document 1, failure detection is performed by comparing a signal input of a redundant sensor and a calculation result based on the signal input. Therefore, for example, when the calculation is an integral calculation using a past calculation result or the like. The individual variation between the two sensors is integrated and reflected in the calculation result between the two systems. Therefore, when comparing the calculation results of both systems, if the range of normal judgment related to the comparison is not set wide in consideration of the integrated amount of individual variations, frequent failure detection results in failure detection accuracy. Will be reduced.

  An object of the present invention is to provide an electronic control device capable of improving failure detection accuracy.

In order to solve the above problems, the invention described in claim 1 includes a plurality of control members each having an input system and a calculation system, and capable of transmitting and receiving data to and from each other. The input system individually inputs the detection signals of the sensors that detect the physical quantities of the actuators, A / D converts them, and performs output processing according to the detection signals. The calculation system of these control members outputs to the actuators In the electronic control device for controlling the driving signal to be output, a first comparison means for comparing output results of the respective input systems and a first failure for detecting a failure when the output results are not matched by the first comparison means When these output results coincide with each other by the detection means and the first comparison means, the calculation system of these control members is the same among the calculation systems of these control members. The second comparison means for individually performing the same calculation process based on the output result of the input system, comparing whether the calculation results of the calculation systems are the same, and the calculation result by the second comparison means Second failure detection means for detecting a failure when the calculation results are not the same, and when the calculation result is the same by the second comparison means, the calculation of any one of these control members The gist is that the calculation result of the system is output to the actuator to control the drive signal .

The invention according to claim 2 includes a plurality of control members each having an input system and a calculation system, and capable of transmitting and receiving data to each other, and the input system of these control members detects a physical quantity of the actuator. a plurality of the same type of sensor one sensor this by individually inputted detection signals have line output processing corresponding to the a / D converted detection signal, the operation system of the control member, the actuator In the electronic control device for controlling the drive signal to be output, the first comparison means for comparing the output results of the respective input systems, and the first comparison means for detecting a failure when the output results are not matched by the first comparison means. a failure detecting means, when these output results are a match by said first comparator means, calculating strains of the control member, any one is identical between computing systems of the control member And be performed separately from each other the same arithmetic processing based on the output result of the input channel, and the second comparison means for the operation result of each operation system compares whether the same, these calculation results by the second comparing means when but that is not the same, and a second failure detecting means for fault detection, when it is with these calculation results are the same by said second comparing means, one of said operation of the control member The gist is that the calculation result of the system is output to the actuator to control the drive signal .

The gist of a third aspect of the present invention is that, in the second aspect, in addition to the plurality of same types of sensors, a plurality of different types of sensors are provided .

(Function)
According to the first and second aspects of the invention, the output results of the respective input systems are compared by the first comparing means. Since the range relating to the determination of coincidence / mismatch of these output results by the first comparison means can basically be set to a limited range that can encompass individual variations such as the input system of each sensor and each control member, the first Failure detection by the failure detection means is performed more strictly. Further, the calculation results of the respective calculation systems are compared by the second comparison means. The calculation systems of these control members individually perform the same calculation process based on the output result of any one of the input systems, that is, the common output result. Therefore, the determination of the coincidence / mismatch of these calculation results by the second comparison means can be basically made based on whether or not these calculation results are the same, so that the failure detection by the second failure detection means is performed more strictly. As described above, it is possible to suppress the allowable range related to each determination from expanding in failure detection, and to improve failure detection accuracy. Further, since the redundant configuration includes a plurality of control members each having an input system and an arithmetic system, failure detection accuracy is further improved.

According to the third aspect of the present invention , the actuator can be more strictly controlled by using two different types of sensors.

  As described above in detail, in the inventions according to claims 1 to 3, the failure detection accuracy can be improved in the electronic control device.

(First embodiment)
A first embodiment of the present invention will be described below with reference to FIG. The control system 10 according to the present embodiment has two similar sensors A1 and A2 that detect the physical quantity of the actuator 11 that is a detection target, and a drive that inputs the detection signals of these sensors A1 and A2 and outputs the detected signals to the actuator 11. And an electronic control unit (hereinafter referred to as “ECU”) 12 for controlling signals. The ECU 12 is configured as a microcomputer (hereinafter referred to as “microcomputer”), a central processing unit (hereinafter referred to as “CPU”) that performs calculation and control, a memory such as ROM and RAM that performs storage, and an external device. An input / output interface for connection is provided.

  As shown in FIG. 1 with a part of the processing performed by the CPU of the ECU 12 as a block, the ECU 12 includes an input interface 13 and an arithmetic processing unit 14. The input interface 13 inputs the detection signal of the sensor A1, which is an analog signal, performs A / D (analog / digital) conversion on the detection signal, and stores an input system 15 that stores a digital value corresponding to the detection signal in the RAM. I have. The input interface 13 is also provided with an input system 16 for inputting the detection signal of the sensor A2, which is also an analog signal, A / D converting the detection signal, and storing a digital value corresponding to the detection signal in the RAM.

  The arithmetic processing unit 14 includes a first comparison unit 21 as a first comparison unit that compares digital values stored in the RAM by the input systems 15 and 16. The first comparison unit 21 determines the magnitude of the deviation of the digital values and the predetermined threshold value when determining whether the digital values match or do not match. That is, the first comparison unit 21 determines that the deviation is equal when the magnitude of the deviation is smaller than a predetermined threshold, and determines that the deviation is not equal when the magnitude of the deviation is larger than the predetermined threshold. This predetermined threshold is the individual variation of the sensors A1 and A2, the noise characteristics of the input interface 13, and the individual variation (conversion) of the A / D converter when the A / D converter is provided for each of the input systems 15 and 16. It is set to a suitable value that can absorb errors and the like. The first comparison unit 21 also has a function as first failure detection means for detecting a failure when it is determined that the digital values do not match. As the cause of the failure, for example, abnormalities of the sensors A1 and A2, the input interface 13, the RAM, and the like can be considered. However, when a failure is detected, the control of the drive signal output to the actuator 11 is stopped.

  In addition, when the first comparison unit 21 determines that these digital values match, the arithmetic processing unit 14 individually performs the same arithmetic processing based on the digital values stored in the RAM by one input system 15. Two arithmetic systems 22 and 23 are provided. The calculation system 22 includes calculation units 22a, 22b, and 22c obtained by dividing a series of calculation processes in order by a plurality of (here, three) steps. The calculation system 23 also includes calculation units 23a, 23b, and 23c obtained by dividing a series of calculation processes in order by a plurality of (here, three) steps. The calculation units 22a and 23a, the calculation units 22b and 23b, and the calculation units 22c and 23c are the same calculation process.

  Further, the arithmetic processing unit 14 includes a second comparison unit 24 as a second comparison unit that compares the operation values in the respective operation systems 22 and 23. The second comparison unit 24 determines whether or not these calculation values are the same when determining whether the calculation values of the calculation systems 22 and 23 match. In other words, the second comparison unit 24 determines that the calculated values are the same and determines that they are the same, and determines that the calculated values are not the same when the calculated values are not the same.

  Note that the second comparison unit 24 also has a function as second failure detection means for detecting a failure when it is determined that the calculated values do not match. As a cause of the failure, for example, an abnormality such as a ROM or a RAM can be considered, but when a failure is detected, the control of the drive signal output to the actuator 11 is stopped. When the second comparison unit 24 determines that these calculation values match, the calculation value in one calculation system 22 is output to the actuator 11 and its drive signal is controlled.

As described above in detail, according to the present embodiment, the following effects can be obtained.
(1) In the present embodiment, the first comparison unit 21 compares the digital values stored in the RAM by the input systems 15 and 16. The predetermined threshold for determining whether the digital values match or not by the first comparator 21 is basically a limited threshold that can include individual variations of the sensors A1 and A2, noise characteristics of the input interface 13, and the like. Therefore, failure detection by the first comparison unit 21 (first failure detection means) is performed more strictly. Further, the operation values of the operation systems 22 and 23 are compared by the second comparison unit 24. These arithmetic systems 22 and 23 individually perform the same arithmetic processing based on a digital value stored in the RAM by one input system 15, that is, a common digital value. Therefore, the second comparison unit 24 can basically determine whether the calculated values match or do not match regardless of the complexity of the calculation in the calculation system. Failure detection by the unit 24 (second failure detection means) is performed more strictly. As described above, it is possible to suppress the permissible range related to each determination from expanding in failure detection, and to improve failure detection accuracy.

(Second Embodiment)
Hereinafter, a second embodiment of the present invention will be described with reference to FIG. The control system 30 according to the second embodiment includes two sensors B1 and B2 of the same type that detect physical quantities different from the sensors A1 and A2 in addition to the sensors A1 and A2. And different. That is, the sensors A1 and A2 and the sensors B1 and B2 constitute two types of sensor groups.

  As shown in FIG. 2, the control system 30 according to the present embodiment includes an ECU 31 that inputs detection signals of the sensors A1 and A2 and the sensors B1 and B2 and controls a drive signal output to the actuator 11. . The ECU 31 is configured as a microcomputer, and includes a CPU for calculating and controlling, a memory such as a ROM and a RAM for storing, an input / output interface for connection to the outside, and the like.

  As shown in FIG. 2 with a part of the processing performed by the CPU of the ECU 31 as a block, the ECU 31 includes an input interface 32 and an arithmetic processing unit 33. The input interface 32 inputs the detection signal of the sensor A1, which is an analog signal, A / D converts it, and stores the digital value corresponding to the detection signal in the RAM. An input system 35 is provided that inputs a detection signal of a certain sensor A2, performs A / D conversion on the detection signal, and stores a digital value corresponding to the detection signal in a RAM. The input interface 32 receives the detection signal of the sensor B1, which is an analog signal, performs A / D conversion, and stores a digital value corresponding to the detection signal in the RAM. An input system 37 for inputting a detection signal of a certain sensor B2, A / D-converting it, and storing a digital value corresponding to the detection signal in a RAM is provided.

  The arithmetic processing unit 33 includes a first A comparison unit 41 as a first comparison unit that compares digital values stored in the RAM by the input systems 34 and 35. The first A comparison unit 41 determines the magnitude of the deviation of the digital values and the predetermined threshold value when determining whether the digital values match or do not match. That is, the first A comparison unit 41 determines that the deviation is equal when the magnitude of the deviation is smaller than a predetermined threshold, and determines that the deviation is not equal when the magnitude of the deviation is larger than the predetermined threshold. This predetermined threshold is the individual variation of the sensors A1 and A2, the noise characteristics of the input interface 32, and the individual variation (conversion) of the A / D converter when each input system 34 and 35 is provided with an A / D converter. It is set to a suitable value that can absorb errors and the like.

  The arithmetic processing unit 33 includes a first B comparison unit 42 as a first comparison unit that compares digital values stored in the RAM by the input systems 36 and 37. The first B comparison unit 42 determines the magnitude of the deviation of the digital values and the predetermined threshold value when determining whether the digital values match or do not match. This predetermined threshold is the individual variation of the sensors B1 and B2, the noise characteristics of the input interface 32, and the individual variation (conversion) of the A / D converter when each input system 36 and 37 is provided with an A / D converter. It is set to a suitable value that can absorb errors and the like.

  The first A comparison unit 41 and the first B comparison unit 42 also have a function as first failure detection means for detecting a failure when the corresponding digital values are determined to be inconsistent. As the cause of the failure, for example, abnormalities such as the sensors A1 and A2, the sensors B1 and B2, the input interface 32, and the RAM may be considered, but when any failure is detected, the control of the drive signal output to the actuator 11 is stopped. It has become so.

  Further, the arithmetic processing unit 33, when the first A comparison unit 41 and the first B comparison unit 42 determine that the digital values match, respectively, each digital system stored in the RAM by the one input system 34, 36. Two arithmetic systems 43 and 44 that individually perform the same arithmetic processing based on the values are provided. The relationship between the calculation units 43a, 43b, 43c of the calculation system 43 and the calculation units 44a, 44b, 44c of the calculation system 44 is the same as that of the first embodiment.

  In addition, the arithmetic processing unit 33 includes a second comparison unit 45 as a second comparison unit that compares the arithmetic values in the arithmetic systems 43 and 44. The second comparison unit 45 determines whether or not these calculation values are the same in determining whether the calculation values of the calculation systems 43 and 44 match. That is, the second comparison unit 45 determines that the calculated values are the same and determines that they are the same, and determines that they are not the same when the calculated values are not the same.

  Note that the second comparison unit 45 also has a function as second failure detection means for detecting a failure when it is determined that the calculated values do not match. As a cause of the failure, for example, an abnormality such as a ROM or a RAM can be considered, but when a failure is detected, the control of the drive signal output to the actuator 11 is stopped. When the second comparison unit 45 determines that these calculation values match, the calculation value in one calculation system 43 is output to the actuator 11 and its drive signal is controlled.

  As described above in detail, according to the present embodiment, the same effect as in the first embodiment can be obtained. In particular, by using two different types of sensors (sensors A1, A2, sensors B1, B2), the actuator 11 can be controlled more strictly.

(Third embodiment)
Hereinafter, a third embodiment of the present invention will be described with reference to FIG. The control system 50 according to the third embodiment is different from the first and second embodiments in that the ECU 51 includes two microcomputers 52 and 53. These are equipped with a CPU for calculation and control, a memory such as ROM and RAM for storage, an input / output interface for connection to the outside, etc., and methods such as serial communication or parallel communication via the input / output interface Thus, data (calculated values, etc.) can be exchanged between them.

  As shown in FIG. 3 in which the processing by the CPUs of the microcomputers 52 and 53 is partly shown as a block, one microcomputer 52 includes an input interface 54 and an arithmetic processing unit 55, and the other microcomputer 53 includes An input interface 56 and an arithmetic processing unit 57 are provided.

  The input interface 54 of the microcomputer 52 includes an input system 58 that inputs a detection signal of the sensor A1, which is an analog signal, A / D converts the detection signal, and stores a digital value corresponding to the detection signal in the RAM. Similarly, the input interface 56 of the microcomputer 53 is provided with an input system 59 for inputting the detection signal of the sensor A2 that is an analog signal, A / D-converting it, and storing a digital value corresponding to the detection signal in the RAM. ing.

  The arithmetic processing unit 55 of one microcomputer 52 serves as a first comparison unit that compares the digital value stored in the RAM by the input system 58 and the digital value stored in the RAM by the input system 59 received from the microcomputer 53. A first comparison unit 60 is provided. The first comparison unit 60 determines the magnitude of the deviation of the digital values and the predetermined threshold when determining whether the digital values match or do not match. That is, the first comparison unit 60 determines that the deviation is equal when the magnitude of the deviation is smaller than a predetermined threshold, and determines that the deviation is not equal when the magnitude of the deviation is larger than the predetermined threshold. This predetermined threshold value is set to a suitable value that can absorb individual variations of the sensors A1 and A2, noise characteristics of the input interfaces 54 and 56, and individual variations (conversion errors, etc.) of the A / D converter. Note that the first comparison unit 60 also has a function as first failure detection means for detecting a failure when it is determined that the digital values do not match. Possible causes of the failure include, for example, abnormalities in the sensors A1 and A2, the input / output interfaces (input interfaces 54 and 56) of one of the microcomputers 52 and 53, the RAM, and the like. Control of the drive signal is stopped.

  The arithmetic processing unit 55 also includes an arithmetic system 61 that performs arithmetic processing based on the digital value stored in the RAM by one input system 58 when the first comparison unit 60 determines that these digital values match. ing.

  The arithmetic processing unit 57 of the other microcomputer 53 receives the digital value stored in the RAM by the one input system 58 when the first comparison unit 60 determines that the digital values match, based on this. The calculation system 62 is configured to perform the same calculation process as the calculation system 61. The relationship between the calculation units 61a, 61b, 61c of the calculation system 61 and the calculation units 62a, 62b, 62c of the calculation system 62 is the same as that in the first embodiment.

  Further, the arithmetic processing unit 55 of one microcomputer 52 includes a second comparison unit 63 as a second comparison unit that compares the operation value in the operation system 61 with the operation value in the operation system 62 received from the microcomputer 53. Yes. The second comparison unit 63 determines whether or not these calculation values are the same when determining whether the calculation values of the calculation systems 61 and 62 match. That is, the second comparison unit 63 determines that they match when these calculation values are the same, and determines that they do not match when they are not the same. The second comparison unit 63 also has a function as second failure detection means for detecting a failure when it is determined that the calculated values do not match. As a cause of this failure, for example, abnormalities in the CPU (ALU, etc.), ROM, RAM, input / output interface, etc. of one of the microcomputers 52 and 53 can be considered. Is to be stopped. When the second comparison unit 63 determines that these calculation values match, the calculation value in one calculation system 61 is output to the actuator 11 and its drive signal is controlled.

  (1) In this embodiment, the first comparison unit 60 compares the digital values stored in the corresponding RAMs by the input systems 58 and 59. The predetermined threshold value for determining whether the digital values match or not by the first comparison unit 60 basically includes individual variations of the sensors A1 and A2 and the input systems 58 and 59 of the microcomputers 52 and 53. Since it can be set to a limited range, failure detection by the first comparison unit 60 (first failure detection means) is performed more strictly. In addition, the operation values of the operation systems 61 and 62 are compared by the second comparison unit 63. The arithmetic systems 61 and 62 of the microcomputers 52 and 53 individually perform the same arithmetic processing based on digital values stored in the RAM by one input system 58, that is, common digital values. Therefore, the second comparison unit 63 can basically determine whether the calculated values match or do not match, regardless of the complexity of the calculation in the calculation system. Failure detection by the unit 63 (second failure detection means) is performed more strictly. As described above, it is possible to suppress the permissible range related to each determination from expanding in failure detection, and to improve failure detection accuracy. Further, since the redundant configuration includes the two microcomputers 52 and 53 having the input systems 58 and 59 and the arithmetic systems 61 and 62, respectively, the failure detection accuracy can be further improved.

(Fourth embodiment)
Hereinafter, a fourth embodiment of the present invention will be described with reference to FIG. Note that the control system 66 of the fourth embodiment includes two sensors B1 and B2 of the same type that detect physical quantities different from the sensors A1 and A2 in addition to the sensors A1 and A2. And different. That is, the sensors A1 and A2 and the sensors B1 and B2 constitute two types of sensor groups.

  As shown in FIG. 4, the ECU 67 included in the control system 66 of this embodiment is composed of two microcomputers 68 and 69. Each of the microcomputers 68 and 69 includes a CPU for calculating and controlling, a memory such as a ROM and a RAM for storing, an input / output interface for connection to the outside, and the like, and serial communication or parallel via the input / output interface. Data (computed values, etc.) can be exchanged with each other by a method such as communication.

  As shown in FIG. 4 in which the processing by the CPUs of the microcomputers 68 and 69 is partially shown as a block, one microcomputer 68 includes an input interface 70 and an arithmetic processing unit 71, and the other microcomputer 69 includes An input interface 72 and an arithmetic processing unit 73 are provided.

  The input interface 70 of the microcomputer 68 inputs the detection signal of the sensor A1, which is an analog signal, A / D converts it, and stores a digital value corresponding to the detection signal in the RAM. And an input system 75 for inputting the detection signal of the sensor B1 and A / D converting the signal and storing a digital value corresponding to the detection signal in the RAM. The input interface 70 of the microcomputer 69 receives the detection signal of the sensor A2, which is an analog signal, A / D converts it, and stores a digital value corresponding to the detection signal in the RAM. And an input system 77 for inputting the detection signal of the sensor B2 and A / D converting the signal and storing a digital value corresponding to the detection signal in the RAM.

  The arithmetic processing unit 71 of one microcomputer 68 serves as a first comparison unit that compares the digital value stored in the RAM by the input system 74 and the digital value stored in the RAM by the input system 76 received from the microcomputer 69. A first A comparison unit 78 is provided. The arithmetic processing unit 71 of the microcomputer 68 serves as a first comparison unit that compares the digital value stored in the RAM by the input system 75 with the digital value stored in the RAM by the input system 77 received from the microcomputer 69. The 1B comparison part 79 is provided.

  The first A comparison unit 78 determines the magnitude of the deviation of the digital values and the predetermined threshold value in determining whether the digital values match or do not match. That is, the first A comparison unit 78 determines that the deviation is equal when the magnitude of the deviation is smaller than a predetermined threshold, and determines that the deviation is not equal when the magnitude of the deviation is larger than the predetermined threshold. This predetermined threshold value is set to a suitable value that can absorb individual variations of the sensors A1 and A2, noise characteristics of the input interfaces 70 and 72, and individual variations (conversion errors, etc.) of the A / D converter.

  Similarly, the 1B comparison unit 79 determines the magnitude of the deviation of the digital values and the predetermined threshold value in determining whether the digital values match or do not match. This predetermined threshold value is set to a suitable value that can absorb individual variations of the sensors B1 and B2, noise characteristics of the input interfaces 70 and 72, and individual variations (conversion errors, etc.) of the A / D converter.

  The first A comparison unit 78 and the first B comparison unit 79 also have a function as first failure detection means for detecting a failure when it is determined that the corresponding digital values do not match. Possible causes of the failure include, for example, abnormalities in the sensors A1 and A2, the sensors B1 and B2, the input / output interfaces (input interfaces 70 and 72) of one of the microcomputers 68 and 69, the RAM, and the like. When this is done, control of the drive signal output to the actuator 11 is stopped.

  Further, the arithmetic processing unit 71 of the one microcomputer 68 uses the one input system 74 and the input system 75 when the first A comparison unit 78 and the first B comparison unit 79 determine that the digital values match. An arithmetic system 80 that performs arithmetic processing based on each digital value stored in the RAM is provided.

  In addition, the arithmetic processing unit 73 of the other microcomputer 69 uses the one input system 74 and the input system 75 when the first A comparison unit 78 and the first B comparison unit 79 determine that the digital values match. It is configured as an arithmetic system 81 that receives a digital value stored in the RAM and performs the same arithmetic processing as the arithmetic system 80 based on the digital value. The relationship between the calculation units 80a, 80b, and 80c of the calculation system 80 and the calculation units 81a, 81b, and 81c of the calculation system 81 is the same as that in the first embodiment.

  Further, the arithmetic processing unit 71 of one microcomputer 68 includes a second comparison unit 82 as a second comparison unit that compares the arithmetic value in the arithmetic system 80 with the arithmetic value in the arithmetic system 81 received from the microcomputer 69. Yes. The second comparison unit 82 determines whether or not these calculation values are the same when determining whether the calculation values of the calculation systems 80 and 81 match or do not match. That is, the second comparison unit 82 determines that they match when these calculated values are the same, and determines that they do not match when they are not the same.

  Note that the second comparison unit 82 also has a function as second failure detection means for detecting a failure when it is determined that the calculated values do not match. As a cause of this failure, for example, abnormalities in the CPU (ALU, etc.), ROM, RAM, input / output interface, etc. of one of the microcomputers 68 and 69 can be considered. Is to be stopped. When the second comparison unit 82 determines that these calculation values match, the calculation value in one calculation system 80 is output to the actuator 11 and its drive signal is controlled.

  As described above in detail, according to the present embodiment, the same effect as in the third embodiment can be obtained. In particular, by using two different types of sensors (sensors A1, A2, sensors B1, B2), the actuator 11 can be controlled more strictly.

(Fifth embodiment)
Hereinafter, a fifth embodiment of the present invention will be described with reference to FIG. The control system 86 of the fifth embodiment is a single sensor A that detects the physical quantity of the actuator 11 that is a detection target, and a drive that internally inputs the detection signal and outputs it to the actuator 11. It differs from 1st Embodiment that ECU87 which controls a signal was provided. The ECU 87 is configured as a microcomputer, and includes a CPU that performs calculation and control, a memory such as a ROM and a RAM that stores data, an input / output interface for connection to the outside, and the like.

  As shown in FIG. 5 by partially blocking the processing by the CPU of the ECU 87, the ECU 87 includes an input interface 88 and an arithmetic processing unit 89. Then, the input interface 88 inputs the detection signals of the sensor A, which are analog signals, A / D converts them, and stores two input systems 90 and 91 that store digital values corresponding to the detection signals in the RAM. I have.

  The arithmetic processing unit 89 includes a first comparison unit 92 as a first comparison unit according to the first embodiment. However, in determining whether the digital values match or do not match, a strict predetermined threshold value is set corresponding to the use of a common detection signal. The arithmetic processing unit 89 individually performs the same arithmetic processing based on the digital values stored in the RAM by one input system 90 when the first comparison unit 92 determines that these digital values match. Two arithmetic systems 93 and 94 are provided. Further, the arithmetic processing unit 89 includes a second comparing unit 95 as a second comparing unit that compares the arithmetic values in the arithmetic systems 93 and 94. Since the functions of the calculation system 93 (calculation units 93a, 93b, 93c), the calculation system 94 (calculation units 94a, 94b, 94c), and the second comparison unit 95 are the same as those in the first embodiment, detailed description is omitted. To do.

As described above in detail, according to the present embodiment, the following effects can be obtained.
(1) In this embodiment, the first comparison unit 92 compares the digital values stored in the RAM by the input systems 90 and 91. These digital values are based on the detection signal of one sensor A that is common. For this reason, the predetermined threshold value for determining whether the digital values match or not by the first comparison unit 92 is a limited threshold value that can include the noise characteristics of the input interface 88 and individual variations of the A / D converter. Therefore, failure detection by the first comparison unit 92 (first failure detection means) is performed more strictly. Further, the second comparison unit 95 compares the operation values of the operation systems 93 and 94. These arithmetic systems 93 and 94 individually perform the same arithmetic processing based on a digital value stored in the RAM by one input system 90, that is, a common digital value. Therefore, the second comparison unit 95 can basically determine whether the calculated values match or do not match regardless of the complexity of the calculation in the calculation system. Failure detection by the unit 95 (second failure detection means) is performed more strictly. As described above, it is possible to suppress the permissible range related to each determination from expanding in failure detection, and to improve failure detection accuracy.

(Sixth embodiment)
Hereinafter, a sixth embodiment of the present invention will be described with reference to FIG. The control system 96 of the sixth embodiment differs from that of the fifth embodiment in that it includes an ECU 97 that internally triples the detection signal of the sensor A.

  As shown in FIG. 6 in which the processing of the CPU of the ECU 97 is partly blocked, the ECU 97 includes an input interface 98 and an arithmetic processing unit 99. The input interface 98 receives the detection signals of the sensor A which are analog signals, A / D converts them, and stores digital values corresponding to the detection signals in the RAM. 102.

  The arithmetic processing unit 99 includes a first comparison unit 103 as a first comparison unit that compares digital values stored in the RAM by the input systems 100, 101, and 102. The first comparison unit 103 selects and sets any one of the digital values in a manner to be described later along with the comparison of the digital values. The first comparison unit 103 also has a function as first failure detection means for detecting failure when any digital value cannot be selected. As the cause of the failure, for example, abnormalities in the sensor A, the input interface 98, the RAM, and the like can be considered. However, when a failure is detected, the control of the drive signal output to the actuator 11 is stopped.

  The arithmetic processing unit 99 includes three arithmetic systems 104, 105, and 106 that individually perform the same arithmetic processing based on the digital value set by the first comparison unit 103. The calculation system 104 includes calculation units 104a, 104b, and 104c obtained by dividing a series of calculation processes in order by a plurality of (here, three) steps. The arithmetic system 105 also includes arithmetic units 105a, 105b, and 105c obtained by dividing a series of arithmetic processes in order by a plurality of (here, three) steps. Furthermore, the calculation system 106 also includes calculation units 106a, 106b, and 106c obtained by dividing a series of calculation processes in order by a plurality of (here, three) steps. The arithmetic units 104a, 105a, 106a, the arithmetic units 104b, 105b, 106b, and the arithmetic units 104c, 105c, 106c are the same arithmetic processing.

  Further, the arithmetic processing unit 99 includes a second comparison unit 107 as a second comparison unit that compares the operation values in the respective operation systems 104, 105, and 106. The second comparison unit 107 performs a majority decision when determining whether the calculated values match or do not match. Specifically, the second comparison unit 107 performs a match determination when all or all two of the calculation values in the calculation systems 104, 105, and 106 are the same. At this time, the same calculated value is output to the actuator 11 to control the drive signal.

  In addition, the second comparison unit 107 performs a mismatch determination when all the operation values in the operation systems 104, 105, and 106 are different. The second comparison unit 107 also has a function as second failure detection means for detecting a failure when it is determined that the calculated values do not match. As a cause of the failure, for example, an abnormality such as a ROM or a RAM can be considered, but when a failure is detected, the control of the drive signal output to the actuator 11 is stopped.

  Next, a digital value selection and setting mode in the first comparison unit 103 will be described. This digital value selection setting is processed in accordance with the priority order. FIG. 7 is a flowchart showing a digital value selection mode executed by the CPU of the ECU 97. When the processing shifts to this routine, the CPU performs a determination in the normal range of the digital value stored in the RAM by the input system 100 in S (step) 1. In this process, the digital value is determined to be normal based on a determination as to whether or not the digital value falls within a preset normal range.

  Next, the CPU proceeds to S2 and performs the same normal range determination for the digital value stored in the RAM by the input system 101. Further, the CPU proceeds to S3 and changes the digital value stored in the RAM by the input system 102. The same normal range determination is performed for the same.

  In S4, the CPU determines whether two or more of the digital values stored in the RAM by these input systems 100, 101, 102 are normal. If it is determined that two or more are normal, the CPU proceeds to S5 to select the highest priority among the normal digital values, and select this one for each operation system 104, 105, 106.

  In the present embodiment, in the initial setting, the priority order that increases in the order of the digital values stored in the RAM by the input system 100, the input system 101, and the input system 102 is set. For example, if the digital value stored in the RAM by the input system 100 having the highest priority is normal, the digital value is selected. Further, if the digital value stored in the RAM by the input system 100 is abnormal and the digital value stored in the RAM by the input system 101 is normal, this digital value is selected.

  If it is determined in S4 that two or more are not normal, the CPU proceeds to S6 to determine whether only one of the digital values is normal. Here, when one of the digital values is determined to be normal, the CPU proceeds to S7 to select the digital value determined to be normal and expand it to the respective computation systems 104, 105, and 106 in the next stage. If it is determined in S6 that none of the digital values is normal (all are not normal), the CPU proceeds to S8 and detects a failure without selecting any digital value.

The CPU that has performed one of the processes of S5, S7, and S8 once ends the process related to the selection and setting of the digital value in the first comparison unit 103.
As described above in detail, according to the present embodiment, the same effect as in the fifth embodiment can be obtained. In particular, the detection accuracy of the sensor A can be further improved by tripling the detection signal of the sensor A to detect the failure.

(Seventh embodiment)
A seventh embodiment embodying the present invention will be described below with reference to FIG. Note that the control system 110 according to the seventh embodiment includes the ECU 111 that performs determination (majority determination) of coincidence / non-coincidence of operation values in the operation processing unit for each operation unit constituting the operation system. Different from form. Therefore, the same parts are denoted by the same reference numerals, and the description thereof is partially omitted.

  As shown in FIG. 8 by partially blocking the processing by the CPU of the ECU 111, the arithmetic processing unit 112 of the ECU 111 individually performs the same arithmetic processing based on the digital value selected and set by the first comparison unit 103. Three arithmetic units 113a, 113b, and 113c to perform are provided.

  In addition, the arithmetic processing unit 112 includes a second comparison unit 114 that compares the arithmetic values in the arithmetic units 113a, 113b, and 113c. The second comparison unit 114 makes a determination by majority vote when determining whether the calculated values match or do not match. Specifically, the second comparison unit 114 performs the coincidence determination when all of the calculation values in the calculation units 113a, 113b, and 113c, or any two of them are the same. At this time, the same calculation value (here, the calculation value in the calculation unit 113a) is expanded to the calculation units 115a, 115b, and 115c in the next stage of the calculation processing unit 112. In addition, the second comparison unit 114 performs a mismatch determination when all of the calculation values in the calculation units 113a, 113b, and 113c are different.

The three calculation units 115a, 115b, and 115c individually perform the same calculation process based on the calculation values developed by the second comparison unit 114.
In addition, the arithmetic processing unit 112 includes a third comparison unit 116 that compares the arithmetic values in the arithmetic units 115a, 115b, and 115c. Similarly to the second comparison unit 114, the third comparison unit 116 also makes a determination by majority decision in determining whether the calculated values match or do not match. At this time, the same calculation value (here, the calculation value in the calculation unit 115b) is expanded to the calculation units 117a, 117b, and 117c in the next stage of the calculation processing unit 112. In addition, the third comparison unit 116 performs mismatch determination when all of the calculation values in the calculation units 115a, 115b, and 115c are different.

The three calculation units 117a, 117b, and 117c individually perform the same calculation process based on the calculation values developed by the third comparison unit 116.
Further, the arithmetic processing unit 112 includes a fourth comparison unit 118 that compares the arithmetic values in the respective arithmetic units 117a, 117b, and 117c. Similarly to the second comparison unit 114 and the third comparison unit 116, the fourth comparison unit 118 also performs determination by majority decision in determining whether the calculated values match or do not match. At this time, the same calculation value (here, the calculation value in the calculation unit 117a) is output to the actuator 11 to control the drive signal. In addition, the third comparison unit 116 performs mismatch determination when all of the calculation values in the calculation units 115a, 115b, and 115c are different.

  Note that the second, third, and fourth comparison units 114, 116, and 118 also have a function as second failure detection means that detects a failure when it is determined that the operation values related to the comparison do not match. As a cause of the failure, for example, an abnormality such as a ROM or a RAM can be considered, but when a failure is detected, the control of the drive signal output to the actuator 11 is stopped.

  As described above in detail, according to this embodiment, the same effect as that of the sixth embodiment can be obtained. In particular, it is possible to further improve the detection accuracy of failure detection by performing the determination (majority determination) of coincidence / mismatch of operation values in the operation processing unit 112 for each operation unit constituting the operation system. Further, the second, third, and fourth comparison units 114, 116, and 118 can detect the failure step by step. Furthermore, since the calculated values are developed for each of the second, third, and fourth comparison units 114, 116, and 118, failure detection can be performed more flexibly.

In addition, you may change the said embodiment as follows.
-In the said 1st-4th embodiment, you may employ | adopt the form provided with three or more types of sensors.

-In the said 5th-7th embodiment, you may employ | adopt the form provided with two or more types of sensors.
-In the said 1st-6th embodiment, you may make it perform the comparison of the calculated value in a calculation system for every calculating part.

  In each of the above embodiments, a configuration is adopted in which a digital value obtained by A / D converting a detection signal, which is an analog signal, in the input system is stored in the RAM. On the other hand, when the detection signal is a digital signal, it may be received by a technique such as serial communication or parallel communication and stored in the RAM in the input system.

In each of the above embodiments, an A / D converter may be provided for each input system, or an A / D converter may be used in each input system.
In each of the above-described embodiments, the mode in which the drive signal of the actuator 11 is controlled by the calculated value calculated by the ECU has been described. However, for example, the calculated value may be output (transmitted) to another controller. Good.

  In each of the above embodiments, the number of stages of the calculation unit in each calculation system may be other than three.

1 is a system block diagram showing a first embodiment of the present invention. The system block diagram which shows the 2nd Embodiment of this invention. The system block diagram which shows the 3rd Embodiment of this invention. The system block diagram which shows the 4th Embodiment of this invention. The system block diagram which shows the 5th Embodiment of this invention. The system block diagram which shows the 6th Embodiment of this invention. The flowchart which shows the 6th Embodiment of this invention. The system block diagram which shows the 7th Embodiment of this invention.

Explanation of symbols

  A, A1, A2, B1, B2 ... Sensor, 12, 31, 51, 67, 87, 97, 111 ... ECU, 15, 16, 34 to 37, 58, 59, 74 to 77, 90, 91, 100 to 102... Input system, 21, 60, 92, 103... First comparison unit as first comparison means constituting first failure detection means, 22, 23, 43, 44, 61, 62, 80, 81, 93, 94, 104, 105 ... arithmetic system, 24, 45, 63, 82, 95, 107, 118 ... second comparison unit as second comparison means constituting second failure detection means, 41, 78 ... first failure detection 1A comparison unit as a first comparison unit constituting the means, 42, 79... 1B comparison unit as a first comparison unit constituting the first failure detection unit, 52, 53, 68, 69. Microcomputer.

Claims (3)

It has a plurality of control members that each have an input system and a computation system and can exchange data with each other. The input system of these control members individually inputs detection signals of sensors that detect physical quantities of actuators. The A / D conversion is performed and output processing is performed according to the detection signal. The calculation system of these control members is an electronic control device that controls the drive signal output to the actuator.
First comparison means for comparing the output results of each of the input systems;
First failure detection means for detecting a failure when the output results are not matched by the first comparison means;
When these output results are matched by the first comparison means, the calculation systems of these control members are the same between the calculation systems of these control members based on the output results of any one of the input systems. Individually performing the processing of
Second comparison means for comparing whether the calculation results of the respective calculation systems are the same;
A second failure detection unit for detecting a failure when the second comparison unit determines that the calculation results are not the same;
When the calculation results are the same by the second comparison means, the calculation result of any one of the calculation systems of these control members is output to the actuator to control the drive signal. Electronic control device. Having an input line and an arithmetic system, respectively, comprising a plurality of control members has become possible to exchange data between the input system of the control member, of the sensors of a plurality of the same type for detecting a physical quantity of the actuator 1 One of have line output process corresponding to the individual input to which the a / D converted detection signal a detection signal of a sensor, calculation system of the control member, an electronic control for controlling the drive signal to be output to the actuator In the device
First comparison means for comparing the output results of each of the input systems;
First failure detection means for detecting a failure when the output results are not matched by the first comparison means;
When these output results are matched by the first comparison means, the calculation systems of these control members are the same between the calculation systems of these control members based on the output results of any one of the input systems. Individually performing the processing of
Second comparison means for comparing whether the calculation results of the respective calculation systems are the same ;
A second failure detection unit for detecting a failure when the second comparison unit determines that the calculation results are not the same ;
When the calculation results are the same by the second comparison means, the calculation result of any one of the calculation systems of these control members is output to the actuator to control the drive signal. Electronic control device. The electronic control device according to claim 2, further comprising a plurality of different types of sensors in addition to the plurality of same types of sensors.

Images